add privilege revocation